Privacy Req 2 - Revision history

Omaerz: 20 revisions imported: Initial Upload of old pages from IDESG Wiki

2018-06-28T04:03:00Z

20 revisions imported: Initial Upload of old pages from IDESG Wiki

← Older revision	Revision as of 04:03, 28 June 2018
(No difference)

Mary Hodder: syntax

2018-06-18T18:00:22Z

syntax

← Older revision		Revision as of 18:00, 18 June 2018
Line 21:		Line 21:
	procedures that limit linkages between transactions and facilitate credential portability. This includes		procedures that limit linkages between transactions and facilitate credential portability. This includes
	functions defined as “Blinding,” “Pseudonymization/Anonymization,” and “Exchange.”		functions defined as “Blinding,” “Pseudonymization/Anonymization,” and “Exchange.”

	~~'''Supplemental Guidance''' <br>~~
	These links are provided as additional informative resources relevant to parties conducting self-assessments (and other identity stakeholders) when applying and evaluating IDEF Baseline Requirement PRIVACY-2.

	=== Supplemental Information ===		=== Supplemental Information ===

Mary Hodder: added appendix A supplemental information

2018-06-18T17:58:48Z

added appendix A supplemental information

← Older revision		Revision as of 17:58, 18 June 2018
Line 22:		Line 22:
	functions defined as “Blinding,” “Pseudonymization/Anonymization,” and “Exchange.”		functions defined as “Blinding,” “Pseudonymization/Anonymization,” and “Exchange.”

	~~See~~ also [[Privacy ~~Req~~ 2 ~~Supplemental Guidance~~]].		'''Supplemental Guidance''' <br>
			These links are provided as additional informative resources relevant to parties conducting self-assessments (and other identity stakeholders) when applying and evaluating IDEF Baseline Requirement PRIVACY-2.

			=== Supplemental Information ===

			Contracts, assurances or persistent records of consent or legal authority MUST be established by entities collecting, using, transmitting or storing personal information, so that the information, when passed between entities, is still used in the same manner as originally specified and permitted. Entities also must assure that their data controls reliably apply these limitations to their future actions.

			Please note the applicability of requirement [[Interop_Req_7\|INTEROP-7]] regarding limitations imposed by laws. Please note the applicability of requirements [[Interop_Req_6\|INTEROP-6]] and [[Interop_Req_8\|INTEROP-8]] regarding limitations arising from the involvement of THIRD-PARTIES such as intermediaries, similar service providers, or FEDERATIONS.

			=== References and Guidance (non-normative) ===

			* See ISO/IEC 29100 (2011) Privacy Framework, Section 5.3 ("Use, Retention and Disclosure Limitation") and Section 5.6 ("Purpose Legitimacy and Specification").
			* See the "minimum necessary" disclosure standard in HIPAA regulations for health care transactions, 45 CFR Part 164, at §§ 164.502(b) and 164.514(d): http://www.ecfr.gov/cgi-bin/text-idx?node=pt45.1.164&rgn=div5
			* See also the Fair Information Privacy Principles: "Organizations should use PII solely for the purpose(s) specified in the notice. Sharing PII should be for a purpose compatible with the purpose for which the PII was collected." http://www.nist.gov/nstic/NSTIC-FIPPs.pdf
			* See OASIS Privacy Management Reference Model (PMRM) v1.0: Section 4.2 ("Service Details").
			* See Privacy & Biometrics: Building a Conceptual Foundation: Data [p46],Audit [p47], and Storage [p47].


	=== REFERENCES ===		=== REFERENCES ===
Line 29:		Line 45:

	=== APPLIES TO ROLES ===		=== APPLIES TO ROLES ===
	~~1 -~~ [[IDEF Glossary RELYING PARTIES\|RELYING PARTIES]] <br>		[[IDEF Glossary RELYING PARTIES\|RELYING PARTIES]] <br>
	~~2 -~~ [[IDEF Glossary IDENTITY PROVIDERS\|IDENTITY PROVIDERS]] <br>		[[IDEF Glossary IDENTITY PROVIDERS\|IDENTITY PROVIDERS]] <br>
	~~3 -~~ Attribute Providers <br>		Attribute Providers <br>
	~~4 –~~ Intermediaries <br>		Intermediaries <br>
	~~5 -~~ Credential Service Providers (where there is user interaction) <br>		Credential Service Providers (where there is user interaction) <br>

Mary Hodder: Added roles for phase II

2018-06-13T20:34:02Z

Added roles for phase II

New page

''<< Back to [[Baseline_Functional_Requirements_v1.0|Baseline Functional Requirements Index]]''

== PRIVACY-2. PURPOSE LIMITATION ==
Entities MUST limit the use of [[IDEF Glossary PERSONAL INFORMATION|personal information]] that is collected, used, transmitted, or stored to the specified purposes of that transaction. Persistent records of contracts, assurances, consent, or legal authority MUST be established by entities collecting, generating, using, transmitting, or storing personal information, so that the information consistently is used in the same manner originally specified and permitted.

=== SUPPLEMENTAL GUIDANCE ===
Regarding "personal information", see [[APPENDIX_A-Defined_Terms|Appendix A]]. Entities should also assure that their data
controls reliably apply these limitations to their future actions.

See also Requirement [[Privacy Req 1|PRIVACY-1 (DATA MINIMIZATION)]] on the application of limitations to, and
scope of, individual transactions and data exchanges.

Please note the applicability of best practice [[Interop Best Practice G|INTEROP-BP-G (RECOMMENDED LEGAL COMPLIANCE)]]
regarding limitations imposed by laws. Please note the applicability of best practice [[Interop Best Practice F|INTEROP-BP-F
(RECOMMENDED FEDERATION COMPLIANCE)]] and Requirement [[Interop Req 6|INTEROP-6 (THIRD-PARTY
COMPLIANCE)]] regarding limitations arising from the involvement of THIRD-PARTIES such as
intermediaries, similar service providers, or FEDERATIONS.

See the [https://workspace.idesg.org/kws/public/download.php/53/IDEF-Functional-Model-v1.0.pdf IDESG Functional Model] for definition of Transaction Intermediation for the scope of
“intermediaries.” The functional model describes Transaction Intermediation as “Processes and
procedures that limit linkages between transactions and facilitate credential portability. This includes
functions defined as “Blinding,” “Pseudonymization/Anonymization,” and “Exchange.”

See also [[Privacy Req 2 Supplemental Guidance]].

=== REFERENCES ===
Further reference materials to aid organizations interested in conforming to these Requirements can be found at the wiki page [[Supplemental Privacy Guidance]]; this has been archived at https://workspace.idesg.org/kws/public/download.php/56/Supplemental-Privacy-Guidance.docx

=== APPLIES TO ROLES ===
1 - [[IDEF Glossary RELYING PARTIES|RELYING PARTIES]] 
2 - [[IDEF Glossary IDENTITY PROVIDERS|IDENTITY PROVIDERS]] 
3 - Attribute Providers 
4 – Intermediaries 
5 - Credential Service Providers (where there is user interaction) 

=== APPLIES TO ACTIVITIES ===
[[IDEF Functional Model REGISTRATION|REGISTRATION]], [[IDEF Functional Model CREDENTIALING|CREDENTIALING]], [[IDEF Functional Model AUTHENTICATION|AUTHENTICATION]], [[IDEF Functional Model AUTHORIZATION|AUTHORIZATION]], [[IDEF Functional Model INTERMEDIATION|INTERMEDIATION]]

=== KEYWORDS ===
[[IDEF Keywords LIMITATION|LIMITATION]], [[IDEF Keywords PRIVACY|PRIVACY]], [[IDEF Keywords PURPOSE|PURPOSE]]

----
----
Quick Links: [[SALS]] | [[Baseline Functional Requirements v1.0]] | [[Glossary]] |

----
----